sb-as logo
Story image

Foxit acknowledges zero-days in its PDF software, but no patches yet

21 Aug 2017

Popular PDF tool Foxit Reader has two zero-day vulnerabilities that, if exploited, could give attackers the ability to execute malicious vbscript code on startup.

The vulnerabilities, publicly exposed by the Zero Day Initiatives and AusCERT, affect all versions of Foxit Reader and Foxit PhantomPDF.

The first vulnerability, CVE-2017-10951, is a zero-day involving Foxit Reader’s launchURL Command Injection Remote Code Vulnerability.

According to AusCERT, user interaction such as going to a malicious page or opening a malicious file is required to exploit the vulnerability, which was flagged by security researchers.

“The specific flaw exists within app.launchURL method. The issue result from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process,” a statement from AusCERT says.

Foxit will not be issuing a patch for the vulnerability. It instead released a statement that encourages users to use “Safe Reading Mode”.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company states.

AusCERT says that the only useful mitigation strategy is to only use Foxit with trusted files.

The second vulnerability, CVE-2017-10952, is a zero-day involving Foxit’s Arbitrary File Write Remote Code Execution Vulnerability.

Attackers can launch an attack that also must involve user interaction through a malicious page or file, however this time the issue is with the saveAs Javascript function.

“The issue results from the lack of proper validation of user-supplied data, which can lead to writing arbitrary files into attacker controlled locations. An attacker can leverage this vulnerability to execute code under the context of the current process,” AusCERT states.

Foxit Reader is not patching this vulnerability either, and once again suggests that Safe Reading is the answer.

"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions,” the company says in a statement.

AusCERT also says that for this vulnerability, people should only use Foxit Reader for trusted files.

Story image
Gigamon & FireEye tackle security in hybrid cloud environments
The partnership is an extension to a ‘long-standing’ relationship that aims to ‘simplify, secure, and optimise hybrid cloud environments’.More
Story image
Video: 10 Minute IT Jams - Radware VP on the challenges of cloud security
In this interview, Techday speaks to Radware vice president of technologies Yaniv Hoffman, who discusses the primary challenges facing IT organisations in terms of their cloud security apparatus.More
Story image
Why a more secure organisation is a collective responsibility
With vast volumes of data moving to the cloud, many IT professionals are frequently challenged to protect their enterprise environment, and there is a greater focus being placed on advancing cybersecurity strategies.More
Story image
Video: 10 Minute IT Jams - Who is Okta?
Okta is an identity and access management company, specialising in secure user authentication. It's an enterprise-grade identity management service, built for the cloud, but compatible with many on-premises applications.More
Story image
IT leaders prioritising automation, Zero Trust and API-based security investments
"The study shows that a cocktail of multiplying threats, the proliferation of hybrid and cloud architectures, blended with a pandemic-fuelled explosion in distributed and remote work has created a perfect storm for network security teams."More
Story image
Microsoft Exchange breach a wake-up call to ditch the server
"There are owners who still have in-house exchange servers because they are suspicious of the cloud or have concerns about their data sovereignty or don't want to contemplate the capital expenditure. But the warning is clear. Get rid of them."More